60ffa1b9286ecbabaff06c3a9f5cbbac181087003cecedcd90d4878a78571d17

Analysis

max time kernel
899s
max time network
475s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustDevblogCheatChecker-main/Run-HDD.bat
Size 151B
Sample261102-qlzbjsfc27
SHA256 60ffa1b9286ecbabaff06c3a9f5cbbac181087003cecedcd90d4878a78571d17
MD5 2699235ac26647cfa1d96cf28635f7f0
SHA1 f2d0e1d332d42fc04fb7b6b49b05773c759cbdd1
SHA512 9bf8355f9f7e4f5902312d4fb7c33b144e3b369b9d95180cac23d32ec3579c4b13662e619eb3761d743dad5dad65bae6f83b85e02e230a78887a6abbb2ae8836
TLSH
T171C08C446AA9AB88E1A34C2150EB60605C1FA207A3084D21B3A2823F200E285C1651D6
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5256	powershell.exe
3	5256	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1872	Everything.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\D:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5256	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
704	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5256	powershell.exe
5256	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5256	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	Everything.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1872	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1872	Everything.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5256	704	cmd.exe	91
PID 5256 wrote to memory of 1632	5256	powershell.exe	92
PID 1632 wrote to memory of 3792	1632	csc.exe	93
PID 5256 wrote to memory of 1360	5256	powershell.exe	94
PID 5256 wrote to memory of 1872	5256	powershell.exe	95
PID 5256 wrote to memory of 5772	5256	powershell.exe	96
PID 5256 wrote to memory of 5052	5256	powershell.exe	97
PID 5256 wrote to memory of 1728	5256	powershell.exe	98
PID 5256 wrote to memory of 5092	5256	powershell.exe	99
PID 5256 wrote to memory of 4448	5256	powershell.exe	101
PID 5256 wrote to memory of 3340	5256	powershell.exe	102
PID 5256 wrote to memory of 5936	5256	powershell.exe	103
PID 5256 wrote to memory of 3492	5256	powershell.exe	104
PID 5256 wrote to memory of 2128	5256	powershell.exe	105
PID 5256 wrote to memory of 3652	5256	powershell.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Run-HDD.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1" -Threads 2
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqdmnkdf\xqdmnkdf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES119A.tmp" "c:\Users\Admin\AppData\Local\Temp\xqdmnkdf\CSC7392310DFA20452C90E0447C3EBF67E0.TMP"
      4⤵
      PID:3792
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
    3⤵
    PID:5772
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-f584da1fed3b4804a58954f12d2d38d0.csv -no-header -full-path-and-name -size -size-format 1
    3⤵
    PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5044

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES119A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES119A.tmp
Size 1KB
SHA256 29331af9e0fb4cdf1a67b2dc712448a8a9982375849e715b4da806df0806b740
MD5 12884370b4b95585c1a4a0b830f03ebc
SHA1 c04131d5aef6764013ebccd6517cee4e801e22b1
SHA512 513049c53131ddaf58a0d758dfd651974a35e19ab8cb4f4e61c9af1628c72547cdf6e1846d3c5dcf6fa4c1597dbafa863336fb3808f72f44955cb52f531e8940
TLSH
T1A221AD0493ED870FF0B34B3169F6132FA665FD24EF629766858442281C41644FEB0B73
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
Size 2.2MB
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

everything-candidates-f584da1fed3b4804a58954f12d2d38d0.csv

Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-f584da1fed3b4804a58954f12d2d38d0.csv
Size 588KB
SHA256 48848b4326c81de5afc803ed94a23ad92190976fa2b66a364d70bd891aacebdd
MD5 40c991af424b0d03ca1ca65fc2d1b556
SHA1 6fb33f6efaa1bef0d4dc4c77fcb8ac1e5308bd07
SHA512 9e2f9ed1592db55ea3c16697d7191fffe31dba875ae220f20134b59da1a8395e2527406bd70476cf075a1d8ce5c548c199daa2836867480af6bb3a454a889310
SSDEEP 6144:F5qLN0D6SoSypuoXNQFHOpFJjcCYrKYDgzFgkO6K:+XwjkOz
TLSH
T1C4D4EE11C23246F3D6B3AC52A26E1745F11A3103B3815E39B3A77052FEDA1476FB69B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xqdmnkdf.dll

Path C:\Users\Admin\AppData\Local\Temp\xqdmnkdf\xqdmnkdf.dll
Size 10KB
SHA256 030a63d07f2550f5807f94a256a37b7698e59e93203b48aebb06ef8117f6c383
MD5 c00d3b935507298429b2fd2096177675
SHA1 059e7b67ec39e34f1727f360d99d4162021005e0
SHA512 5a5ca5d6e51bae9ec629685dd80dc1de2913a2f96a404dd63cf43a12ee7036c278ce26370cb9c1fa8f4b1dcc9069ffb7263d758d138533eeee5ddf924311101a
SSDEEP 192:JeV/By+pJF8abjd0ZBslf/DbmSEDDpy06ZbzzWLquENmx5:0vp9d0MxDbGNy06JX8US
TLSH
T12D221A1A73DD8A7BC85F8B7C20E1175A5670C6136722EF1BBCC4A1581C937A84E752B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7392310DFA20452C90E0447C3EBF67E0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xqdmnkdf\CSC7392310DFA20452C90E0447C3EBF67E0.TMP
Size 652B
SHA256 89ee5e9d9d6c4c951ee62b421873b3d4ff252217d20f58891a057b4bb567b133
MD5 33e31f8e8d615640fbca5cfbd9fd34ef
SHA1 71ed8f7c7ba731d1a15582a346d343d3116d82f8
SHA512 695344a28c221c3b0072afe634fe18743406304f85a40eb3a7ae980c549023a1c5a4f5f8cb113517909a65d488137037bfc82e81641e87edf09ad915cfa7a9a9
TLSH
T190F03A0963F8420EF0F34B30B9F64367A1A9BD65DE3293ED645003692C646109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xqdmnkdf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xqdmnkdf\xqdmnkdf.0.cs
Size 11KB
SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
MD5 a3a3c564a75a927d0220c2ef741743dd
SHA1 0689adf722e1e848583168c176a9877261c1316f
SHA512 422febe123bf0776c618cfd0cb7a5f366302982e7404af349ed0b755c4990d95e6242b9a917fededb787e0ebd62ef7c90003062ed79c4199668312150d564631
SSDEEP 192:iodqeqxNvqgZr04WSL/UzaJS5qpde4EtXW/vQOB83HXrWQ/8VtTiSCD8XClyizzM:iodqeq3yg0vXXa6a9B
TLSH
T1A032A51938A795685643317E8BC7828266329217529CED70FECC8044AF43858FAFCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xqdmnkdf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xqdmnkdf\xqdmnkdf.cmdline
Size 455B
SHA256 dc23d808abaec77ac2c1241e7a29a30d3aebf94cf1ec956bfc0ee08e8b6ffb8f
MD5 815053be40151d818af5dacbff9237c1
SHA1 6103011abc0fd5c358b117e6f34a6ab02e0d39f9
SHA512 48072792eb64af9d2338a18509cbf56cb070abfb340c33c204aae993c9eecbfab8aa6c6efcfd4d4476e1fbb2cf2f7cf78c92f5234d80afc6f25be2418c92ab9c
TLSH
T13DF05C25423EC77E45EB24071969897CC23203472681EF4455D4CD1FD1538001B91B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5256-23-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-27-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-14-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-6-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-5-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-21-0x0000015925E30000-0x0000015925FF2000-memory.dmp

Download

memory/5256-22-0x0000015926530000-0x0000015926A58000-memory.dmp

Download

memory/5256-0-0x00007FFD036DF000-0x00007FFD036E0000-memory.dmp

Download

memory/5256-24-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-25-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-26-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-20-0x000001590D190000-0x000001590D19A000-memory.dmp

Download

memory/5256-28-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-29-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-30-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-32-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-33-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-34-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-35-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download

memory/5256-37-0x00000159257F0000-0x00000159257FA000-memory.dmp

Download

memory/5256-38-0x0000015925830000-0x0000015925842000-memory.dmp

Download

memory/5256-2-0x000001590D1A0000-0x000001590D1C2000-memory.dmp

Download

memory/5256-1-0x00007FFD03550000-0x00007FFD03EF4000-memory.dmp

Download